@nexartis/sentinel-sdk 1.7.0 → 1.8.0

package/dist/sveltekit/client/index.js

@@ -9,21 +9,43 @@
  */
 let isRefreshing = false;
 let refreshPromise = null;
-async function refreshAccessToken() {
+function composeSignals(signals) {
+    const live = signals.filter((s) => s);
+    if (live.length === 0) {
+        return new AbortController().signal;
+    }
+    if (live.length === 1) {
+        return live[0];
+    }
+    if (typeof AbortSignal.any === 'function') {
+        return AbortSignal.any(live);
+    }
+    const controller = new AbortController();
+    const onAbort = () => {
+        const reason = live.find((s) => s.aborted)?.reason;
+        if (!controller.signal.aborted)
+            controller.abort(reason);
+    };
+    for (const signal of live) {
+        if (signal.aborted) {
+            onAbort();
+            return controller.signal;
+        }
+        signal.addEventListener('abort', onAbort, { once: true });
+    }
+    return controller.signal;
+}
+async function refreshAccessToken(callerSignal) {
     if (isRefreshing && refreshPromise) {
         return refreshPromise;
     }
     isRefreshing = true;
     refreshPromise = (async () => {
         try {
-            // The refresh sub-call is intentionally NOT wrapped in the caller's
-            // timeoutMs. It has its own well-behaved backend contract and we do
-            // not want a mid-refresh abort to leave the client with partially
-            // rotated tokens. If refresh itself hangs pathologically the
-            // browser/network stack will eventually fail it.
             const response = await fetch('/api/auth/refresh', {
                 method: 'POST',
-                credentials: 'include'
+                credentials: 'include',
+                signal: callerSignal ?? undefined
             });
             if (response.ok) {
                 const result = await response.json();
@@ -65,7 +87,7 @@ function buildAttemptSignal(callerSignal, timeoutMs) {
     if (!callerSignal) {
         return timeoutSignal;
     }
-    return AbortSignal.any([callerSignal, timeoutSignal]);
+    return composeSignals([callerSignal, timeoutSignal]);
 }
 /**
  * Authenticated fetch wrapper with automatic token refresh.
@@ -84,7 +106,7 @@ export async function authFetch(url, options) {
         signal: buildAttemptSignal(callerSignal, effectiveTimeout)
     });
     if (response.status === 401) {
-        const refreshed = await refreshAccessToken();
+        const refreshed = await refreshAccessToken(callerSignal);
         if (refreshed) {
             // Attempt #2 — brand new timeout budget. Do NOT reuse attempt #1's
             // signal (that budget may already be nearly exhausted); build a

package/dist/sveltekit/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sveltekit/client/index.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;;;;;;GAOG;AAEH,IAAI,YAAY,GAAG,KAAK,CAAC;AACzB,IAAI,cAAc,GAA4B,IAAI,CAAC;AAEnD,KAAK,UAAU,kBAAkB;IAChC,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;QACpC,OAAO,cAAc,CAAC;IACvB,CAAC;IAED,YAAY,GAAG,IAAI,CAAC;IACpB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC;YACJ,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,6DAA6D;YAC7D,iDAAiD;YACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;YAChC,CAAC;YAED,OAAO,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACV,YAAY,GAAG,KAAK,CAAC;YACrB,cAAc,GAAG,IAAI,CAAC;QACvB,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,cAAc,CAAC;AACvB,CAAC;AA0BD,oEAAoE;AACpE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAC1B,YAA4C,EAC5C,SAAiB;IAEjB,MAAM,eAAe,GAAG,SAAS,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,eAAe,EAAE,CAAC;QACrB,OAAO,YAAY,IAAI,SAAS,CAAC;IAClC,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,GAAiB,EACjB,OAA0B;IAE1B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC1E,MAAM,gBAAgB,GAAG,SAAS,IAAI,kBAAkB,CAAC;IAEzD,iEAAiE;IACjE,IAAI,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC/B,GAAG,WAAW;QACd,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,gBAAgB,CAAC;KAC1D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAE7C,IAAI,SAAS,EAAE,CAAC;YACf,mEAAmE;YACnE,gEAAgE;YAChE,8DAA8D;YAC9D,8DAA8D;YAC9D,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,GAAG,WAAW;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,gBAAgB,CAAC;aAC1D,CAAC,CAAC;QACJ,CAAC;QACD,oDAAoD;QACpD,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,2CAA2C;IAC5C,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,GAAiB,EACjB,OAA0B;IAE1B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE/C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC","sourcesContent":["// src/sveltekit/client/index.ts\n\n/**\n * Authenticated fetch wrapper with automatic token refresh.\n *\n * Use for:\n * - Multipart/chunked file uploads\n * - Sequential API calls with delays\n * - Any scenario where token might expire between requests\n */\n\nlet isRefreshing = false;\nlet refreshPromise: Promise<boolean> | null = null;\n\nasync function refreshAccessToken(): Promise<boolean> {\n\tif (isRefreshing && refreshPromise) {\n\t\treturn refreshPromise;\n\t}\n\n\tisRefreshing = true;\n\trefreshPromise = (async () => {\n\t\ttry {\n\t\t\t// The refresh sub-call is intentionally NOT wrapped in the caller's\n\t\t\t// timeoutMs. It has its own well-behaved backend contract and we do\n\t\t\t// not want a mid-refresh abort to leave the client with partially\n\t\t\t// rotated tokens. If refresh itself hangs pathologically the\n\t\t\t// browser/network stack will eventually fail it.\n\t\t\tconst response = await fetch('/api/auth/refresh', {\n\t\t\t\tmethod: 'POST',\n\t\t\t\tcredentials: 'include'\n\t\t\t});\n\n\t\t\tif (response.ok) {\n\t\t\t\tconst result = await response.json();\n\t\t\t\treturn result.success === true;\n\t\t\t}\n\n\t\t\treturn false;\n\t\t} catch (error) {\n\t\t\tconsole.error('Token refresh error:', error);\n\t\t\treturn false;\n\t\t} finally {\n\t\t\tisRefreshing = false;\n\t\t\trefreshPromise = null;\n\t\t}\n\t})();\n\n\treturn refreshPromise;\n}\n\n/**\n * Extended options for {@link authFetch} / {@link authFetchJson}.\n *\n * Adds a per-attempt request timeout on top of the standard `RequestInit`.\n * The timeout is applied INDEPENDENTLY to the initial request and to the\n * post-401-refresh retry, so a slow first attempt does not steal budget from\n * the retry.\n */\nexport interface AuthFetchOptions extends RequestInit {\n\t/**\n\t * Per-attempt timeout in milliseconds.\n\t *\n\t * - Defaults to `60_000` (60 s) when omitted.\n\t * - `0` or `Infinity` disables the internal timeout entirely (caller's\n\t *   own `signal` still applies).\n\t * - The timeout is applied SEPARATELY to attempt #1 and to the post-401\n\t *   refresh retry — each gets a fresh budget.\n\t * - Composed with `options.signal` via `AbortSignal.any([...])` so caller\n\t *   cancellation still works and a tighter caller signal wins.\n\t * - Does NOT apply to the internal `/api/auth/refresh` sub-call.\n\t */\n\ttimeoutMs?: number;\n}\n\n/** Default per-attempt timeout when `timeoutMs` is not provided. */\nconst DEFAULT_TIMEOUT_MS = 60_000;\n\n/**\n * Build the effective per-attempt AbortSignal for a single fetch attempt.\n *\n * - When `timeoutMs` disables the timeout, we pass through the caller signal\n *   (or `undefined`).\n * - When timeout is enabled and the caller supplied a signal, we compose them\n *   with `AbortSignal.any` so whichever aborts first wins.\n *\n * Node engine is >=20 so `AbortSignal.any` / `AbortSignal.timeout` are\n * available; modern browsers (Chrome 116+, Firefox 124+, Safari 17.4+)\n * also ship them.\n */\nfunction buildAttemptSignal(\n\tcallerSignal: AbortSignal | null | undefined,\n\ttimeoutMs: number\n): AbortSignal | undefined {\n\tconst timeoutDisabled = timeoutMs === 0 || !Number.isFinite(timeoutMs);\n\tif (timeoutDisabled) {\n\t\treturn callerSignal ?? undefined;\n\t}\n\tconst timeoutSignal = AbortSignal.timeout(timeoutMs);\n\tif (!callerSignal) {\n\t\treturn timeoutSignal;\n\t}\n\treturn AbortSignal.any([callerSignal, timeoutSignal]);\n}\n\n/**\n * Authenticated fetch wrapper with automatic token refresh.\n *\n * Applies a per-attempt timeout (default 60 s) to attempt #1 and to the\n * post-401-refresh retry. Each attempt gets its OWN fresh timeout budget so\n * a slow first attempt cannot starve the retry. See {@link AuthFetchOptions}.\n */\nexport async function authFetch(\n\turl: string | URL,\n\toptions?: AuthFetchOptions\n): Promise<Response> {\n\tconst { timeoutMs, signal: callerSignal, ...restOptions } = options ?? {};\n\tconst effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n\t// Attempt #1 — fresh timeout budget composed with caller signal.\n\tlet response = await fetch(url, {\n\t\t...restOptions,\n\t\tcredentials: 'include',\n\t\tsignal: buildAttemptSignal(callerSignal, effectiveTimeout)\n\t});\n\n\tif (response.status === 401) {\n\t\tconst refreshed = await refreshAccessToken();\n\n\t\tif (refreshed) {\n\t\t\t// Attempt #2 — brand new timeout budget. Do NOT reuse attempt #1's\n\t\t\t// signal (that budget may already be nearly exhausted); build a\n\t\t\t// fresh one instead. The caller's signal is still honored via\n\t\t\t// AbortSignal.any so external cancellation continues to work.\n\t\t\tresponse = await fetch(url, {\n\t\t\t\t...restOptions,\n\t\t\t\tcredentials: 'include',\n\t\t\t\tsignal: buildAttemptSignal(callerSignal, effectiveTimeout)\n\t\t\t});\n\t\t}\n\t\t// If refresh failed, do NOT hard-redirect to /auth.\n\t\t// With Sentinel's rotating refresh tokens, concurrent requests can\n\t\t// race: one wins the refresh (R1→R2) while the others fail because\n\t\t// R1 is already invalidated. A hard redirect would log the user out\n\t\t// even though the browser already has fresh cookies from the winning\n\t\t// response. Instead, return the original 401 response and let the\n\t\t// caller handle it — polling callers will silently retry on the next\n\t\t// interval with the updated cookies, and SvelteKit's protected-route\n\t\t// redirect handles truly expired sessions.\n\t}\n\n\treturn response;\n}\n\n/**\n * Authenticated fetch wrapper with JSON response parsing\n */\nexport async function authFetchJson<T = any>(\n\turl: string | URL,\n\toptions?: AuthFetchOptions\n): Promise<T> {\n\tconst response = await authFetch(url, options);\n\n\tif (!response.ok) {\n\t\tthrow new Error(`HTTP error! status: ${response.status}`);\n\t}\n\n\treturn response.json();\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sveltekit/client/index.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;;;;;;GAOG;AAEH,IAAI,YAAY,GAAG,KAAK,CAAC;AACzB,IAAI,cAAc,GAA4B,IAAI,CAAC;AAEnD,SAAS,cAAc,CAAC,OAAsB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO,UAAU,CAAC,MAAM,CAAC;QAC1B,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,YAAiC;IAClE,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;QACpC,OAAO,cAAc,CAAC;IACvB,CAAC;IAED,YAAY,GAAG,IAAI,CAAC;IACpB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,YAAY,IAAI,SAAS;aACjC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACrC,OAAO,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;YAChC,CAAC;YAED,OAAO,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACV,YAAY,GAAG,KAAK,CAAC;YACrB,cAAc,GAAG,IAAI,CAAC;QACvB,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,cAAc,CAAC;AACvB,CAAC;AA0BD,oEAAoE;AACpE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAC1B,YAA4C,EAC5C,SAAiB;IAEjB,MAAM,eAAe,GAAG,SAAS,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,eAAe,EAAE,CAAC;QACrB,OAAO,YAAY,IAAI,SAAS,CAAC;IAClC,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,OAAO,cAAc,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,GAAiB,EACjB,OAA0B;IAE1B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC1E,MAAM,gBAAgB,GAAG,SAAS,IAAI,kBAAkB,CAAC;IAEzD,iEAAiE;IACjE,IAAI,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC/B,GAAG,WAAW;QACd,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,gBAAgB,CAAC;KAC1D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEzD,IAAI,SAAS,EAAE,CAAC;YACf,mEAAmE;YACnE,gEAAgE;YAChE,8DAA8D;YAC9D,8DAA8D;YAC9D,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,GAAG,WAAW;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,gBAAgB,CAAC;aAC1D,CAAC,CAAC;QACJ,CAAC;QACD,oDAAoD;QACpD,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,2CAA2C;IAC5C,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,GAAiB,EACjB,OAA0B;IAE1B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE/C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC","sourcesContent":["// src/sveltekit/client/index.ts\n\n/**\n * Authenticated fetch wrapper with automatic token refresh.\n *\n * Use for:\n * - Multipart/chunked file uploads\n * - Sequential API calls with delays\n * - Any scenario where token might expire between requests\n */\n\nlet isRefreshing = false;\nlet refreshPromise: Promise<boolean> | null = null;\n\nfunction composeSignals(signals: AbortSignal[]): AbortSignal {\n\tconst live = signals.filter((s) => s);\n\tif (live.length === 0) {\n\t\treturn new AbortController().signal;\n\t}\n\tif (live.length === 1) {\n\t\treturn live[0];\n\t}\n\tif (typeof AbortSignal.any === 'function') {\n\t\treturn AbortSignal.any(live);\n\t}\n\tconst controller = new AbortController();\n\tconst onAbort = () => {\n\t\tconst reason = live.find((s) => s.aborted)?.reason;\n\t\tif (!controller.signal.aborted) controller.abort(reason);\n\t};\n\tfor (const signal of live) {\n\t\tif (signal.aborted) {\n\t\t\tonAbort();\n\t\t\treturn controller.signal;\n\t\t}\n\t\tsignal.addEventListener('abort', onAbort, { once: true });\n\t}\n\treturn controller.signal;\n}\n\nasync function refreshAccessToken(callerSignal?: AbortSignal | null): Promise<boolean> {\n\tif (isRefreshing && refreshPromise) {\n\t\treturn refreshPromise;\n\t}\n\n\tisRefreshing = true;\n\trefreshPromise = (async () => {\n\t\ttry {\n\t\t\tconst response = await fetch('/api/auth/refresh', {\n\t\t\t\tmethod: 'POST',\n\t\t\t\tcredentials: 'include',\n\t\t\t\tsignal: callerSignal ?? undefined\n\t\t\t});\n\n\t\t\tif (response.ok) {\n\t\t\t\tconst result = await response.json();\n\t\t\t\treturn result.success === true;\n\t\t\t}\n\n\t\t\treturn false;\n\t\t} catch (error) {\n\t\t\tconsole.error('Token refresh error:', error);\n\t\t\treturn false;\n\t\t} finally {\n\t\t\tisRefreshing = false;\n\t\t\trefreshPromise = null;\n\t\t}\n\t})();\n\n\treturn refreshPromise;\n}\n\n/**\n * Extended options for {@link authFetch} / {@link authFetchJson}.\n *\n * Adds a per-attempt request timeout on top of the standard `RequestInit`.\n * The timeout is applied INDEPENDENTLY to the initial request and to the\n * post-401-refresh retry, so a slow first attempt does not steal budget from\n * the retry.\n */\nexport interface AuthFetchOptions extends RequestInit {\n\t/**\n\t * Per-attempt timeout in milliseconds.\n\t *\n\t * - Defaults to `60_000` (60 s) when omitted.\n\t * - `0` or `Infinity` disables the internal timeout entirely (caller's\n\t *   own `signal` still applies).\n\t * - The timeout is applied SEPARATELY to attempt #1 and to the post-401\n\t *   refresh retry — each gets a fresh budget.\n\t * - Composed with `options.signal` via `AbortSignal.any([...])` so caller\n\t *   cancellation still works and a tighter caller signal wins.\n\t * - Does NOT apply to the internal `/api/auth/refresh` sub-call.\n\t */\n\ttimeoutMs?: number;\n}\n\n/** Default per-attempt timeout when `timeoutMs` is not provided. */\nconst DEFAULT_TIMEOUT_MS = 60_000;\n\n/**\n * Build the effective per-attempt AbortSignal for a single fetch attempt.\n *\n * - When `timeoutMs` disables the timeout, we pass through the caller signal\n *   (or `undefined`).\n * - When timeout is enabled and the caller supplied a signal, we compose them\n *   with `AbortSignal.any` so whichever aborts first wins.\n *\n * Node engine is >=20 so `AbortSignal.any` / `AbortSignal.timeout` are\n * available; modern browsers (Chrome 116+, Firefox 124+, Safari 17.4+)\n * also ship them.\n */\nfunction buildAttemptSignal(\n\tcallerSignal: AbortSignal | null | undefined,\n\ttimeoutMs: number\n): AbortSignal | undefined {\n\tconst timeoutDisabled = timeoutMs === 0 || !Number.isFinite(timeoutMs);\n\tif (timeoutDisabled) {\n\t\treturn callerSignal ?? undefined;\n\t}\n\tconst timeoutSignal = AbortSignal.timeout(timeoutMs);\n\tif (!callerSignal) {\n\t\treturn timeoutSignal;\n\t}\n\treturn composeSignals([callerSignal, timeoutSignal]);\n}\n\n/**\n * Authenticated fetch wrapper with automatic token refresh.\n *\n * Applies a per-attempt timeout (default 60 s) to attempt #1 and to the\n * post-401-refresh retry. Each attempt gets its OWN fresh timeout budget so\n * a slow first attempt cannot starve the retry. See {@link AuthFetchOptions}.\n */\nexport async function authFetch(\n\turl: string | URL,\n\toptions?: AuthFetchOptions\n): Promise<Response> {\n\tconst { timeoutMs, signal: callerSignal, ...restOptions } = options ?? {};\n\tconst effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n\t// Attempt #1 — fresh timeout budget composed with caller signal.\n\tlet response = await fetch(url, {\n\t\t...restOptions,\n\t\tcredentials: 'include',\n\t\tsignal: buildAttemptSignal(callerSignal, effectiveTimeout)\n\t});\n\n\tif (response.status === 401) {\n\t\tconst refreshed = await refreshAccessToken(callerSignal);\n\n\t\tif (refreshed) {\n\t\t\t// Attempt #2 — brand new timeout budget. Do NOT reuse attempt #1's\n\t\t\t// signal (that budget may already be nearly exhausted); build a\n\t\t\t// fresh one instead. The caller's signal is still honored via\n\t\t\t// AbortSignal.any so external cancellation continues to work.\n\t\t\tresponse = await fetch(url, {\n\t\t\t\t...restOptions,\n\t\t\t\tcredentials: 'include',\n\t\t\t\tsignal: buildAttemptSignal(callerSignal, effectiveTimeout)\n\t\t\t});\n\t\t}\n\t\t// If refresh failed, do NOT hard-redirect to /auth.\n\t\t// With Sentinel's rotating refresh tokens, concurrent requests can\n\t\t// race: one wins the refresh (R1→R2) while the others fail because\n\t\t// R1 is already invalidated. A hard redirect would log the user out\n\t\t// even though the browser already has fresh cookies from the winning\n\t\t// response. Instead, return the original 401 response and let the\n\t\t// caller handle it — polling callers will silently retry on the next\n\t\t// interval with the updated cookies, and SvelteKit's protected-route\n\t\t// redirect handles truly expired sessions.\n\t}\n\n\treturn response;\n}\n\n/**\n * Authenticated fetch wrapper with JSON response parsing\n */\nexport async function authFetchJson<T = any>(\n\turl: string | URL,\n\toptions?: AuthFetchOptions\n): Promise<T> {\n\tconst response = await authFetch(url, options);\n\n\tif (!response.ok) {\n\t\tthrow new Error(`HTTP error! status: ${response.status}`);\n\t}\n\n\treturn response.json();\n}\n"]}

package/dist/sveltekit/handle.d.ts

@@ -1,5 +1,7 @@
 import type { Handle } from '@sveltejs/kit';
 import type { SentinelHandleOptions, UserLocals } from '../core/types.js';
+/** Test-only: reset the once-per-isolate skip-verify warning/refusal latches. */
+export declare function __resetSkipVerifyWarningForTests(): void;
 /** Locals shape set by the Sentinel auth middleware. */
 export interface SentinelLocals {
     user: UserLocals | null;
@@ -9,8 +11,9 @@ export interface SentinelLocals {
  * Creates a SvelteKit handle function with Sentinel authentication built-in.
  *
  * Features:
- * - Local JWT decode on every request (no per-request API call)
- * - API-validated token refresh when expired or structurally invalid
+ * - JWKS signature verification of the access token on every request
+ *   (Ed25519/EdDSA, cached public keys — no per-request API call)
+ * - API-validated token refresh when expired or failing verification
  * - Local expiration check (saves API calls)
  * - Protected route redirection
  * - Sets event.locals.user for all routes

package/dist/sveltekit/handle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handle.d.ts","sourceRoot":"","sources":["../../src/sveltekit/handle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAgB,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAgC,MAAM,kBAAkB,CAAC;AAMxG,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,MAAM,CA0DhF"}
+{"version":3,"file":"handle.d.ts","sourceRoot":"","sources":["../../src/sveltekit/handle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAgB,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAgC,MAAM,kBAAkB,CAAC;AAyCxG,iFAAiF;AACjF,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,MAAM,CA0EhF"}

package/dist/sveltekit/handle.js

@@ -1,13 +1,46 @@
 import { SentinelClient } from '../core/client.js';
 import { isTokenExpired, decodeTokenLocally } from '../core/auth-utils.js';
+import { createJwksVerifier } from '../core/jwks.js';
 import { createLogger } from '../core/logger.js';
 import { COOKIE_NAMES, COOKIE_OPTIONS } from './cookies.js';
+/**
+  * DEVELOPMENT-ONLY escape hatch. When set to "1" (or "true") the handle skips
+  * JWKS signature verification and trusts the decoded token payload, which is
+  * the pre-1.8.0 behaviour and the exact hole the admin-gate audit flagged.
+  * Never set this in production: when NODE_ENV=production the flag is REFUSED
+  * (construction throws for the programmatic option; per-request the flag is
+  * ignored with a loud classified error) and verification always runs.
+  */
+const SKIP_VERIFY_ENV = 'SENTINEL_SKIP_JWKS_VERIFY';
+let skipVerifyWarningEmitted = false;
+function warnSkipVerifyOnce(log) {
+    if (skipVerifyWarningEmitted)
+        return;
+    skipVerifyWarningEmitted = true;
+    log.warn(`${SKIP_VERIFY_ENV} is enabled — JWT signatures are NOT being verified. ` +
+        'Access-token payloads are trusted unverified. Development use only.');
+}
+let skipVerifyRefusalEmitted = false;
+function refuseSkipVerifyInProduction(log) {
+    if (skipVerifyRefusalEmitted)
+        return;
+    skipVerifyRefusalEmitted = true;
+    log.error(`${SKIP_VERIFY_ENV} refused in production (NODE_ENV=production) — ` +
+        'refusing to disable JWKS signature verification. ' +
+        'Unset the flag or run with NODE_ENV=development.');
+}
+/** Test-only: reset the once-per-isolate skip-verify warning/refusal latches. */
+export function __resetSkipVerifyWarningForTests() {
+    skipVerifyWarningEmitted = false;
+    skipVerifyRefusalEmitted = false;
+}
 /**
  * Creates a SvelteKit handle function with Sentinel authentication built-in.
  *
  * Features:
- * - Local JWT decode on every request (no per-request API call)
- * - API-validated token refresh when expired or structurally invalid
+ * - JWKS signature verification of the access token on every request
+ *   (Ed25519/EdDSA, cached public keys — no per-request API call)
+ * - API-validated token refresh when expired or failing verification
  * - Local expiration check (saves API calls)
  * - Protected route redirection
  * - Sets event.locals.user for all routes
@@ -16,6 +49,13 @@ import { COOKIE_NAMES, COOKIE_OPTIONS } from './cookies.js';
 export function createSentinelHandle(options = {}) {
     const { protectedRoutes = [], loginRedirect = '/auth' } = options;
     const log = options.logger ?? createLogger('sentinel-handle');
+    // Fail fast at construction when the unsafe escape hatch is requested in production.
+    if (options.skipJwksVerify === true &&
+        typeof process !== 'undefined' &&
+        process.env?.NODE_ENV === 'production') {
+        throw new Error(`${SKIP_VERIFY_ENV}: skipJwksVerify option refused in production ` +
+            '(NODE_ENV=production) — JWKS signature verification cannot be disabled.');
+    }
     return async ({ event, resolve }) => {
         // Initialize locals with typed shape
         const locals = event.locals;
@@ -23,25 +63,29 @@ export function createSentinelHandle(options = {}) {
         locals.accessToken = null;
         // Get config from environment or options (with request URL fallback)
         const config = getConfig(options, event.platform, event.request.url);
+        const skipVerify = isJwksVerifyDisabled(options, event.platform, log);
+        if (skipVerify)
+            warnSkipVerifyOnce(log);
+        const verifier = skipVerify ? null : createVerifier(options, config, event, log);
         const accessToken = event.cookies.get(COOKIE_NAMES.ACCESS_TOKEN);
         const refreshToken = event.cookies.get(COOKIE_NAMES.REFRESH_TOKEN);
         if (accessToken) {
             if (!isTokenExpired(accessToken)) {
-                const decoded = decodeTokenLocally(accessToken);
+                const decoded = await resolveVerifiedToken(accessToken, verifier, log);
                 if (decoded) {
                     locals.user = createUserLocals(decoded);
                     locals.accessToken = accessToken;
                 }
                 else {
-                    await tryRefreshToken(event, config, refreshToken, log);
+                    await tryRefreshToken(event, config, refreshToken, log, verifier);
                 }
             }
             else if (refreshToken) {
-                await tryRefreshToken(event, config, refreshToken, log);
+                await tryRefreshToken(event, config, refreshToken, log, verifier);
             }
         }
         else if (refreshToken) {
-            await tryRefreshToken(event, config, refreshToken, log);
+            await tryRefreshToken(event, config, refreshToken, log, verifier);
         }
         // Protected routes check — redirect to login with return URL
         const isProtectedRoute = protectedRoutes.some(route => event.url.pathname.startsWith(route));
@@ -61,6 +105,73 @@ export function createSentinelHandle(options = {}) {
         return response;
     };
 }
+/**
+ * Verify an access token's signature against the auth server's JWKS and
+ * return the decoded payload only when the signature checks out.
+ * With `verifier === null` (explicit dev-only opt-out) falls back to the
+ * legacy unverified local decode. Never throws.
+ */
+async function resolveVerifiedToken(accessToken, verifier, log) {
+    if (!verifier) {
+        return decodeTokenLocally(accessToken);
+    }
+    const outcome = await verifier.verify(accessToken);
+    if (outcome.status === 'valid') {
+        return outcome.payload;
+    }
+    log.warn('Access token rejected by signature verification', {
+        status: outcome.status,
+        reason: outcome.reason
+    });
+    return null;
+}
+function isProductionEnvironment(platform) {
+    const platformEnv = platform?.env;
+    const fromPlatform = platformEnv?.NODE_ENV;
+    const fromProcess = typeof process !== 'undefined' ? process.env?.NODE_ENV : undefined;
+    return (fromPlatform ?? fromProcess) === 'production';
+}
+function isJwksVerifyDisabled(options, platform, log) {
+    if (options.skipJwksVerify === true) {
+        if (isProductionEnvironment(platform)) {
+            refuseSkipVerifyInProduction(log);
+            return false;
+        }
+        return true;
+    }
+    const platformEnv = platform?.env;
+    const fromPlatform = platformEnv?.[SKIP_VERIFY_ENV];
+    const fromProcess = typeof process !== 'undefined' ? process.env?.[SKIP_VERIFY_ENV] : undefined;
+    const value = fromPlatform ?? fromProcess;
+    const requested = value === '1' || value === 'true';
+    if (requested && isProductionEnvironment(platform)) {
+        refuseSkipVerifyInProduction(log);
+        return false;
+    }
+    return requested;
+}
+function createVerifier(options, config, event, log) {
+    const platformEnv = event.platform?.env;
+    const jwksUrl = options.jwksUrl || platformEnv?.SENTINEL_JWKS_URL || deriveJwksUrl(config.apiUrl);
+    return createJwksVerifier({
+        jwksUrl,
+        fetchFn: event.fetch,
+        cacheTtlMs: options.jwksCacheTtlMs,
+        logger: log
+    });
+}
+/**
+ * Derive the JWKS URL from the Sentinel API URL. getConfig normalises apiUrl
+ * to `<origin>/api`, so stripping the `/api` suffix yields the origin that
+ * serves `/.well-known/jwks.json`.
+ */
+function deriveJwksUrl(apiUrl) {
+    const origin = apiUrl.endsWith('/api') ? apiUrl.slice(0, -'/api'.length) : apiUrl;
+    let trimmed = origin;
+    while (trimmed.endsWith('/'))
+        trimmed = trimmed.slice(0, -1);
+    return `${trimmed}/.well-known/jwks.json`;
+}
 function getConfig(options, platform, requestUrl) {
     let apiUrl = options.apiUrl || platform?.env?.SENTINEL_API_URL || '';
     let baseUrl = options.baseUrl || platform?.env?.VITE_BASE_URL || '';
@@ -112,7 +223,7 @@ function createUserLocals(decoded) {
         roles: decoded.roles || []
     };
 }
-async function tryRefreshToken(event, config, refreshToken, log) {
+async function tryRefreshToken(event, config, refreshToken, log, verifier) {
     if (!refreshToken)
         return;
     try {
@@ -125,9 +236,11 @@ async function tryRefreshToken(event, config, refreshToken, log) {
                 if (result.refresh_token) {
                     event.cookies.set(COOKIE_NAMES.REFRESH_TOKEN, result.refresh_token, COOKIE_OPTIONS.REFRESH_TOKEN_LONG);
                 }
-                // Local decode — no second API call. The token was just issued by
-                // the Sentinel backend during refresh, so it's already valid.
-                const decoded = decodeTokenLocally(result.access_token);
+                // Verify the freshly-issued token's signature before trusting its
+                // payload (same JWKS path as the cookie flow). The cookie is kept —
+                // it was just minted by the backend over TLS — but locals.user is
+                // only set when verification passes; the next request retries.
+                const decoded = await resolveVerifiedToken(result.access_token, verifier, log);
                 if (decoded) {
                     const locals = event.locals;
                     locals.user = createUserLocals(decoded);

package/dist/sveltekit/handle.js.map

@@ -1 +1 @@
-{"version":3,"file":"handle.js","sourceRoot":"","sources":["../../src/sveltekit/handle.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAuB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ5D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAiC,EAAE;IACvE,MAAM,EACL,eAAe,GAAG,EAAE,EACpB,aAAa,GAAG,OAAO,EACvB,GAAG,OAAO,CAAC;IACZ,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAE9D,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,qCAAqC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAwB,CAAC;QAC9C,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAE1B,qEAAqE;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEnE,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAChD,IAAI,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACxC,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACP,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;gBACzD,CAAC;YACF,CAAC;iBAAM,IAAI,YAAY,EAAE,CAAC;gBACzB,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;QACF,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QAED,6DAA6D;QAC7D,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACrD,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CACpC,CAAC;QAEF,IAAI,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YACzD,MAAM,WAAW,GAAG,GAAG,aAAa,aAAa,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;gBAC/B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;aAClC,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QAEtC,uBAAuB;QACvB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAChD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAE3E,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAA8B,EAAE,QAA4C,EAAE,UAAmB;IACnH,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,IAAK,QAAgC,EAAE,GAAG,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAC9F,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,IAAK,QAAgC,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC;IAE7F,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IAED,6EAA6E;IAC7E,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW;mBAC3C,GAAG,CAAC,QAAQ,KAAK,WAAW;mBAC5B,GAAG,CAAC,QAAQ,KAAK,SAAS;mBAC1B,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC;YAE3B,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,CAAC,UAAU,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1C,QAAQ,GAAG,QAAQ,CAAC;gBACpB,WAAW,GAAG,IAAI,CAAC;YACpB,CAAC;YAED,uDAAuD;YACvD,8DAA8D;YAC9D,2EAA2E;YAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC7E,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,GAAG,GAAG,QAAQ,KAAK,IAAI,GAAG,UAAU,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACR,4CAA4C;QAC7C,CAAC;IACF,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAqB;IAC9C,OAAO;QACN,eAAe,EAAE,IAAI;QACrB,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;KAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAmB,EAAE,MAAsB,EAAE,YAAgC,EAAE,GAAmB;IAChI,IAAI,CAAC,YAAY;QAAE,OAAO;IAE1B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAEzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;gBAE/F,gCAAgC;gBAChC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBAC1B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,kBAAkB,CAAC,CAAC;gBACxG,CAAC;gBAED,kEAAkE;gBAClE,8DAA8D;gBAC9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACxD,IAAI,OAAO,EAAE,CAAC;oBACb,MAAM,MAAM,GAAG,KAAK,CAAC,MAAwB,CAAC;oBAC9C,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACxC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC1C,CAAC;YACF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;AACF,CAAC","sourcesContent":["// src/sveltekit/handle.ts\nimport type { Handle, RequestEvent } from '@sveltejs/kit';\nimport type { SentinelHandleOptions, UserLocals, SentinelConfig, DecodedToken } from '../core/types.js';\nimport { SentinelClient } from '../core/client.js';\nimport { isTokenExpired, decodeTokenLocally } from '../core/auth-utils.js';\nimport { createLogger, type SentinelLogger } from '../core/logger.js';\nimport { COOKIE_NAMES, COOKIE_OPTIONS } from './cookies.js';\n\n/** Locals shape set by the Sentinel auth middleware. */\nexport interface SentinelLocals {\n\tuser: UserLocals | null;\n\taccessToken: string | null;\n}\n\n/**\n * Creates a SvelteKit handle function with Sentinel authentication built-in.\n *\n * Features:\n * - Local JWT decode on every request (no per-request API call)\n * - API-validated token refresh when expired or structurally invalid\n * - Local expiration check (saves API calls)\n * - Protected route redirection\n * - Sets event.locals.user for all routes\n * - Never clears cookies (only explicit logout does)\n */\nexport function createSentinelHandle(options: SentinelHandleOptions = {}): Handle {\n\tconst {\n\t\tprotectedRoutes = [],\n\t\tloginRedirect = '/auth'\n\t} = options;\n\tconst log = options.logger ?? createLogger('sentinel-handle');\n\n\treturn async ({ event, resolve }) => {\n\t\t// Initialize locals with typed shape\n\t\tconst locals = event.locals as SentinelLocals;\n\t\tlocals.user = null;\n\t\tlocals.accessToken = null;\n\n\t\t// Get config from environment or options (with request URL fallback)\n\t\tconst config = getConfig(options, event.platform, event.request.url);\n\n\t\tconst accessToken = event.cookies.get(COOKIE_NAMES.ACCESS_TOKEN);\n\t\tconst refreshToken = event.cookies.get(COOKIE_NAMES.REFRESH_TOKEN);\n\n\t\tif (accessToken) {\n\t\t\tif (!isTokenExpired(accessToken)) {\n\t\t\t\tconst decoded = decodeTokenLocally(accessToken);\n\t\t\t\tif (decoded) {\n\t\t\t\t\tlocals.user = createUserLocals(decoded);\n\t\t\t\t\tlocals.accessToken = accessToken;\n\t\t\t\t} else {\n\t\t\t\t\tawait tryRefreshToken(event, config, refreshToken, log);\n\t\t\t\t}\n\t\t\t} else if (refreshToken) {\n\t\t\t\tawait tryRefreshToken(event, config, refreshToken, log);\n\t\t\t}\n\t\t} else if (refreshToken) {\n\t\t\tawait tryRefreshToken(event, config, refreshToken, log);\n\t\t}\n\n\t\t// Protected routes check — redirect to login with return URL\n\t\tconst isProtectedRoute = protectedRoutes.some(route =>\n\t\t\tevent.url.pathname.startsWith(route)\n\t\t);\n\n\t\tif (isProtectedRoute && !locals.user) {\n\t\t\tconst returnPath = event.url.pathname + event.url.search;\n\t\t\tconst redirectUrl = `${loginRedirect}?redirect=${encodeURIComponent(returnPath)}`;\n\t\t\treturn new Response('Redirect', {\n\t\t\t\tstatus: 302,\n\t\t\t\theaders: { Location: redirectUrl }\n\t\t\t});\n\t\t}\n\n\t\tconst response = await resolve(event);\n\n\t\t// Add security headers\n\t\tresponse.headers.set('X-Frame-Options', 'DENY');\n\t\tresponse.headers.set('X-Content-Type-Options', 'nosniff');\n\t\tresponse.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');\n\n\t\treturn response;\n\t};\n}\n\nfunction getConfig(options: SentinelHandleOptions, platform: Readonly<App.Platform> | undefined, requestUrl?: string): SentinelConfig {\n\tlet apiUrl = options.apiUrl || (platform as Record<string, any>)?.env?.SENTINEL_API_URL || '';\n\tlet baseUrl = options.baseUrl || (platform as Record<string, any>)?.env?.VITE_BASE_URL || '';\n\n\tif (!apiUrl) {\n\t\tthrow new Error('SENTINEL_API_URL must be configured');\n\t}\n\n\t// Normalize: strip trailing slashes, then append /api if not already present\n\twhile (apiUrl.endsWith('/')) apiUrl = apiUrl.slice(0, -1);\n\tif (!apiUrl.endsWith('/api')) {\n\t\tapiUrl = apiUrl + '/api';\n\t}\n\n\t// ARCH-003 fix: Derive baseUrl from request URL when not configured.\n\t// Workers for Platforms deployments don't know their URL at build time.\n\tif (!baseUrl && requestUrl) {\n\t\ttry {\n\t\t\tconst url = new URL(requestUrl);\n\t\t\tconst isLoopback = url.hostname === 'localhost'\n\t\t\t\t|| url.hostname === '127.0.0.1'\n\t\t\t\t|| url.hostname === '0.0.0.0'\n\t\t\t\t|| url.hostname === '::1';\n\n\t\t\tlet protocol = url.protocol;\n\t\t\tlet forcedHttps = false;\n\t\t\tif (!isLoopback && protocol !== 'https:') {\n\t\t\t\tprotocol = 'https:';\n\t\t\t\tforcedHttps = true;\n\t\t\t}\n\n\t\t\t// Build URL with hostname (not host) to avoid carrying\n\t\t\t// default-for-original-scheme ports across a protocol switch.\n\t\t\t// Drop port entirely when forcing HTTPS (Workers serve on standard ports).\n\t\t\tconst host = url.hostname.includes(':') ? `[${url.hostname}]` : url.hostname;\n\t\t\tconst portSuffix = (!forcedHttps && url.port) ? `:${url.port}` : '';\n\t\t\tbaseUrl = `${protocol}//${host}${portSuffix}`;\n\t\t} catch {\n\t\t\t// If URL parsing fails, baseUrl stays empty\n\t\t}\n\t}\n\n\tif (!baseUrl) {\n\t\tthrow new Error('VITE_BASE_URL must be configured (or provide a valid request URL for runtime detection)');\n\t}\n\n\treturn { apiUrl, baseUrl };\n}\n\nfunction createUserLocals(decoded: DecodedToken): UserLocals {\n\treturn {\n\t\tisAuthenticated: true,\n\t\tid: decoded.sub,\n\t\temail: decoded.email,\n\t\troles: decoded.roles || []\n\t};\n}\n\nasync function tryRefreshToken(event: RequestEvent, config: SentinelConfig, refreshToken: string | undefined, log: SentinelLogger): Promise<void> {\n\tif (!refreshToken) return;\n\n\ttry {\n\t\tconst sentinel = new SentinelClient(config, event.fetch);\n\t\tconst result = await sentinel.refreshToken(refreshToken);\n\n\t\tif (result.code === 0 || result.success) {\n\t\t\tif (result.access_token) {\n\t\t\t\tevent.cookies.set(COOKIE_NAMES.ACCESS_TOKEN, result.access_token, COOKIE_OPTIONS.ACCESS_TOKEN);\n\n\t\t\t\t// Handle refresh token rotation\n\t\t\t\tif (result.refresh_token) {\n\t\t\t\t\tevent.cookies.set(COOKIE_NAMES.REFRESH_TOKEN, result.refresh_token, COOKIE_OPTIONS.REFRESH_TOKEN_LONG);\n\t\t\t\t}\n\n\t\t\t\t// Local decode — no second API call. The token was just issued by\n\t\t\t\t// the Sentinel backend during refresh, so it's already valid.\n\t\t\t\tconst decoded = decodeTokenLocally(result.access_token);\n\t\t\t\tif (decoded) {\n\t\t\t\t\tconst locals = event.locals as SentinelLocals;\n\t\t\t\t\tlocals.user = createUserLocals(decoded);\n\t\t\t\t\tlocals.accessToken = result.access_token;\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tlog.warn('Token refresh failed - continuing without user');\n\t\t}\n\t} catch (error) {\n\t\tlog.error('Token refresh error', { error: String(error) });\n\t}\n}\n\n"]}
+{"version":3,"file":"handle.js","sourceRoot":"","sources":["../../src/sveltekit/handle.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAuB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAK5D;;;;;;;IAOI;AACJ,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD,IAAI,wBAAwB,GAAG,KAAK,CAAC;AACrC,SAAS,kBAAkB,CAAC,GAAmB;IAC9C,IAAI,wBAAwB;QAAE,OAAO;IACrC,wBAAwB,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,IAAI,CACP,GAAG,eAAe,uDAAuD;QACxE,qEAAqE,CACtE,CAAC;AACH,CAAC;AAED,IAAI,wBAAwB,GAAG,KAAK,CAAC;AACrC,SAAS,4BAA4B,CAAC,GAAmB;IACxD,IAAI,wBAAwB;QAAE,OAAO;IACrC,wBAAwB,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,KAAK,CACR,GAAG,eAAe,iDAAiD;QAClE,mDAAmD;QACnD,kDAAkD,CACnD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gCAAgC;IAC/C,wBAAwB,GAAG,KAAK,CAAC;IACjC,wBAAwB,GAAG,KAAK,CAAC;AAClC,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAiC,EAAE;IACvE,MAAM,EACL,eAAe,GAAG,EAAE,EACpB,aAAa,GAAG,OAAO,EACvB,GAAG,OAAO,CAAC;IACZ,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAE9D,qFAAqF;IACrF,IACC,OAAO,CAAC,cAAc,KAAK,IAAI;QAC/B,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,EACrC,CAAC;QACF,MAAM,IAAI,KAAK,CACd,GAAG,eAAe,gDAAgD;YACjE,yEAAyE,CAC1E,CAAC;IACH,CAAC;IAED,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,qCAAqC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAwB,CAAC;QAC9C,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAE1B,qEAAqE;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErE,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtE,IAAI,UAAU;YAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAEjF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEnE,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACvE,IAAI,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACxC,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACP,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACnE,CAAC;YACF,CAAC;iBAAM,IAAI,YAAY,EAAE,CAAC;gBACzB,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACnE,CAAC;QACF,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,6DAA6D;QAC7D,MAAM,gBAAgB,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACrD,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CACpC,CAAC;QAEF,IAAI,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YACzD,MAAM,WAAW,GAAG,GAAG,aAAa,aAAa,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;gBAC/B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;aAClC,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QAEtC,uBAAuB;QACvB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAChD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAE3E,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAClC,WAAmB,EACnB,QAA6B,EAC7B,GAAmB;IAEnB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE;QAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,QAA4C;IAC5E,MAAM,WAAW,GAAI,QAAgC,EAAE,GAAyC,CAAC;IACjG,MAAM,YAAY,GAAG,WAAW,EAAE,QAAQ,CAAC;IAC3C,MAAM,WAAW,GAAG,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC,KAAK,YAAY,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAC5B,OAA8B,EAC9B,QAA4C,EAC5C,GAAmB;IAEnB,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACrC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,WAAW,GAAI,QAAgC,EAAE,GAAyC,CAAC;IACjG,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,KAAK,GAAG,YAAY,IAAI,WAAW,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;IACpD,IAAI,SAAS,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,4BAA4B,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACtB,OAA8B,EAC9B,MAAsB,EACtB,KAAmB,EACnB,GAAmB;IAEnB,MAAM,WAAW,GAAI,KAAK,CAAC,QAAgC,EAAE,GAAyC,CAAC;IACvG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,EAAE,iBAAiB,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClG,OAAO,kBAAkB,CAAC;QACzB,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,cAAc;QAClC,MAAM,EAAE,GAAG;KACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,MAAc;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClF,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,OAAO,wBAAwB,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,OAA8B,EAAE,QAA4C,EAAE,UAAmB;IACnH,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,IAAK,QAAgC,EAAE,GAAG,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAC9F,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,IAAK,QAAgC,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC;IAE7F,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IAED,6EAA6E;IAC7E,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW;mBAC3C,GAAG,CAAC,QAAQ,KAAK,WAAW;mBAC5B,GAAG,CAAC,QAAQ,KAAK,SAAS;mBAC1B,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC;YAE3B,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,CAAC,UAAU,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1C,QAAQ,GAAG,QAAQ,CAAC;gBACpB,WAAW,GAAG,IAAI,CAAC;YACpB,CAAC;YAED,uDAAuD;YACvD,8DAA8D;YAC9D,2EAA2E;YAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC7E,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,GAAG,GAAG,QAAQ,KAAK,IAAI,GAAG,UAAU,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACR,4CAA4C;QAC7C,CAAC;IACF,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAqB;IAC9C,OAAO;QACN,eAAe,EAAE,IAAI;QACrB,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;KAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAmB,EAAE,MAAsB,EAAE,YAAgC,EAAE,GAAmB,EAAE,QAA6B;IAC/J,IAAI,CAAC,YAAY;QAAE,OAAO;IAE1B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAEzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;gBAE/F,gCAAgC;gBAChC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBAC1B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,kBAAkB,CAAC,CAAC;gBACxG,CAAC;gBAED,kEAAkE;gBAClE,oEAAoE;gBACpE,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC/E,IAAI,OAAO,EAAE,CAAC;oBACb,MAAM,MAAM,GAAG,KAAK,CAAC,MAAwB,CAAC;oBAC9C,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACxC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC1C,CAAC;YACF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;AACF,CAAC","sourcesContent":["// src/sveltekit/handle.ts\nimport type { Handle, RequestEvent } from '@sveltejs/kit';\nimport type { SentinelHandleOptions, UserLocals, SentinelConfig, DecodedToken } from '../core/types.js';\nimport { SentinelClient } from '../core/client.js';\nimport { isTokenExpired, decodeTokenLocally } from '../core/auth-utils.js';\nimport { createJwksVerifier, type JwksVerifier } from '../core/jwks.js';\nimport { createLogger, type SentinelLogger } from '../core/logger.js';\nimport { COOKIE_NAMES, COOKIE_OPTIONS } from './cookies.js';\n\n// Node fallback for the dev-only skip flag (mirrors src/sveltekit/utils.ts).\ndeclare const process: any;\n\n/**\n  * DEVELOPMENT-ONLY escape hatch. When set to \"1\" (or \"true\") the handle skips\n  * JWKS signature verification and trusts the decoded token payload, which is\n  * the pre-1.8.0 behaviour and the exact hole the admin-gate audit flagged.\n  * Never set this in production: when NODE_ENV=production the flag is REFUSED\n  * (construction throws for the programmatic option; per-request the flag is\n  * ignored with a loud classified error) and verification always runs.\n  */\nconst SKIP_VERIFY_ENV = 'SENTINEL_SKIP_JWKS_VERIFY';\n\nlet skipVerifyWarningEmitted = false;\nfunction warnSkipVerifyOnce(log: SentinelLogger): void {\n\tif (skipVerifyWarningEmitted) return;\n\tskipVerifyWarningEmitted = true;\n\tlog.warn(\n\t\t`${SKIP_VERIFY_ENV} is enabled — JWT signatures are NOT being verified. ` +\n\t\t\t'Access-token payloads are trusted unverified. Development use only.'\n\t);\n}\n\nlet skipVerifyRefusalEmitted = false;\nfunction refuseSkipVerifyInProduction(log: SentinelLogger): void {\n\tif (skipVerifyRefusalEmitted) return;\n\tskipVerifyRefusalEmitted = true;\n\tlog.error(\n\t\t`${SKIP_VERIFY_ENV} refused in production (NODE_ENV=production) — ` +\n\t\t\t'refusing to disable JWKS signature verification. ' +\n\t\t\t'Unset the flag or run with NODE_ENV=development.'\n\t);\n}\n\n/** Test-only: reset the once-per-isolate skip-verify warning/refusal latches. */\nexport function __resetSkipVerifyWarningForTests(): void {\n\tskipVerifyWarningEmitted = false;\n\tskipVerifyRefusalEmitted = false;\n}\n\n/** Locals shape set by the Sentinel auth middleware. */\nexport interface SentinelLocals {\n\tuser: UserLocals | null;\n\taccessToken: string | null;\n}\n\n/**\n * Creates a SvelteKit handle function with Sentinel authentication built-in.\n *\n * Features:\n * - JWKS signature verification of the access token on every request\n *   (Ed25519/EdDSA, cached public keys — no per-request API call)\n * - API-validated token refresh when expired or failing verification\n * - Local expiration check (saves API calls)\n * - Protected route redirection\n * - Sets event.locals.user for all routes\n * - Never clears cookies (only explicit logout does)\n */\nexport function createSentinelHandle(options: SentinelHandleOptions = {}): Handle {\n\tconst {\n\t\tprotectedRoutes = [],\n\t\tloginRedirect = '/auth'\n\t} = options;\n\tconst log = options.logger ?? createLogger('sentinel-handle');\n\n\t// Fail fast at construction when the unsafe escape hatch is requested in production.\n\tif (\n\t\toptions.skipJwksVerify === true &&\n\t\ttypeof process !== 'undefined' &&\n\t\tprocess.env?.NODE_ENV === 'production'\n\t) {\n\t\tthrow new Error(\n\t\t\t`${SKIP_VERIFY_ENV}: skipJwksVerify option refused in production ` +\n\t\t\t\t'(NODE_ENV=production) — JWKS signature verification cannot be disabled.'\n\t\t);\n\t}\n\n\treturn async ({ event, resolve }) => {\n\t\t// Initialize locals with typed shape\n\t\tconst locals = event.locals as SentinelLocals;\n\t\tlocals.user = null;\n\t\tlocals.accessToken = null;\n\n\t\t// Get config from environment or options (with request URL fallback)\n\t\tconst config = getConfig(options, event.platform, event.request.url);\n\n\t\tconst skipVerify = isJwksVerifyDisabled(options, event.platform, log);\n\t\tif (skipVerify) warnSkipVerifyOnce(log);\n\t\tconst verifier = skipVerify ? null : createVerifier(options, config, event, log);\n\n\t\tconst accessToken = event.cookies.get(COOKIE_NAMES.ACCESS_TOKEN);\n\t\tconst refreshToken = event.cookies.get(COOKIE_NAMES.REFRESH_TOKEN);\n\n\t\tif (accessToken) {\n\t\t\tif (!isTokenExpired(accessToken)) {\n\t\t\t\tconst decoded = await resolveVerifiedToken(accessToken, verifier, log);\n\t\t\t\tif (decoded) {\n\t\t\t\t\tlocals.user = createUserLocals(decoded);\n\t\t\t\t\tlocals.accessToken = accessToken;\n\t\t\t\t} else {\n\t\t\t\t\tawait tryRefreshToken(event, config, refreshToken, log, verifier);\n\t\t\t\t}\n\t\t\t} else if (refreshToken) {\n\t\t\t\tawait tryRefreshToken(event, config, refreshToken, log, verifier);\n\t\t\t}\n\t\t} else if (refreshToken) {\n\t\t\tawait tryRefreshToken(event, config, refreshToken, log, verifier);\n\t\t}\n\n\t\t// Protected routes check — redirect to login with return URL\n\t\tconst isProtectedRoute = protectedRoutes.some(route =>\n\t\t\tevent.url.pathname.startsWith(route)\n\t\t);\n\n\t\tif (isProtectedRoute && !locals.user) {\n\t\t\tconst returnPath = event.url.pathname + event.url.search;\n\t\t\tconst redirectUrl = `${loginRedirect}?redirect=${encodeURIComponent(returnPath)}`;\n\t\t\treturn new Response('Redirect', {\n\t\t\t\tstatus: 302,\n\t\t\t\theaders: { Location: redirectUrl }\n\t\t\t});\n\t\t}\n\n\t\tconst response = await resolve(event);\n\n\t\t// Add security headers\n\t\tresponse.headers.set('X-Frame-Options', 'DENY');\n\t\tresponse.headers.set('X-Content-Type-Options', 'nosniff');\n\t\tresponse.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');\n\n\t\treturn response;\n\t};\n}\n\n/**\n * Verify an access token's signature against the auth server's JWKS and\n * return the decoded payload only when the signature checks out.\n * With `verifier === null` (explicit dev-only opt-out) falls back to the\n * legacy unverified local decode. Never throws.\n */\nasync function resolveVerifiedToken(\n\taccessToken: string,\n\tverifier: JwksVerifier | null,\n\tlog: SentinelLogger\n): Promise<DecodedToken | null> {\n\tif (!verifier) {\n\t\treturn decodeTokenLocally(accessToken);\n\t}\n\tconst outcome = await verifier.verify(accessToken);\n\tif (outcome.status === 'valid') {\n\t\treturn outcome.payload;\n\t}\n\tlog.warn('Access token rejected by signature verification', {\n\t\tstatus: outcome.status,\n\t\treason: outcome.reason\n\t});\n\treturn null;\n}\n\nfunction isProductionEnvironment(platform: Readonly<App.Platform> | undefined): boolean {\n\tconst platformEnv = (platform as Record<string, any>)?.env as Record<string, string> | undefined;\n\tconst fromPlatform = platformEnv?.NODE_ENV;\n\tconst fromProcess = typeof process !== 'undefined' ? process.env?.NODE_ENV : undefined;\n\treturn (fromPlatform ?? fromProcess) === 'production';\n}\n\nfunction isJwksVerifyDisabled(\n\toptions: SentinelHandleOptions,\n\tplatform: Readonly<App.Platform> | undefined,\n\tlog: SentinelLogger\n): boolean {\n\tif (options.skipJwksVerify === true) {\n\t\tif (isProductionEnvironment(platform)) {\n\t\t\trefuseSkipVerifyInProduction(log);\n\t\t\treturn false;\n\t\t}\n\t\treturn true;\n\t}\n\tconst platformEnv = (platform as Record<string, any>)?.env as Record<string, string> | undefined;\n\tconst fromPlatform = platformEnv?.[SKIP_VERIFY_ENV];\n\tconst fromProcess = typeof process !== 'undefined' ? process.env?.[SKIP_VERIFY_ENV] : undefined;\n\tconst value = fromPlatform ?? fromProcess;\n\tconst requested = value === '1' || value === 'true';\n\tif (requested && isProductionEnvironment(platform)) {\n\t\trefuseSkipVerifyInProduction(log);\n\t\treturn false;\n\t}\n\treturn requested;\n}\n\nfunction createVerifier(\n\toptions: SentinelHandleOptions,\n\tconfig: SentinelConfig,\n\tevent: RequestEvent,\n\tlog: SentinelLogger\n): JwksVerifier {\n\tconst platformEnv = (event.platform as Record<string, any>)?.env as Record<string, string> | undefined;\n\tconst jwksUrl = options.jwksUrl || platformEnv?.SENTINEL_JWKS_URL || deriveJwksUrl(config.apiUrl);\n\treturn createJwksVerifier({\n\t\tjwksUrl,\n\t\tfetchFn: event.fetch,\n\t\tcacheTtlMs: options.jwksCacheTtlMs,\n\t\tlogger: log\n\t});\n}\n\n/**\n * Derive the JWKS URL from the Sentinel API URL. getConfig normalises apiUrl\n * to `<origin>/api`, so stripping the `/api` suffix yields the origin that\n * serves `/.well-known/jwks.json`.\n */\nfunction deriveJwksUrl(apiUrl: string): string {\n\tconst origin = apiUrl.endsWith('/api') ? apiUrl.slice(0, -'/api'.length) : apiUrl;\n\tlet trimmed = origin;\n\twhile (trimmed.endsWith('/')) trimmed = trimmed.slice(0, -1);\n\treturn `${trimmed}/.well-known/jwks.json`;\n}\n\nfunction getConfig(options: SentinelHandleOptions, platform: Readonly<App.Platform> | undefined, requestUrl?: string): SentinelConfig {\n\tlet apiUrl = options.apiUrl || (platform as Record<string, any>)?.env?.SENTINEL_API_URL || '';\n\tlet baseUrl = options.baseUrl || (platform as Record<string, any>)?.env?.VITE_BASE_URL || '';\n\n\tif (!apiUrl) {\n\t\tthrow new Error('SENTINEL_API_URL must be configured');\n\t}\n\n\t// Normalize: strip trailing slashes, then append /api if not already present\n\twhile (apiUrl.endsWith('/')) apiUrl = apiUrl.slice(0, -1);\n\tif (!apiUrl.endsWith('/api')) {\n\t\tapiUrl = apiUrl + '/api';\n\t}\n\n\t// ARCH-003 fix: Derive baseUrl from request URL when not configured.\n\t// Workers for Platforms deployments don't know their URL at build time.\n\tif (!baseUrl && requestUrl) {\n\t\ttry {\n\t\t\tconst url = new URL(requestUrl);\n\t\t\tconst isLoopback = url.hostname === 'localhost'\n\t\t\t\t|| url.hostname === '127.0.0.1'\n\t\t\t\t|| url.hostname === '0.0.0.0'\n\t\t\t\t|| url.hostname === '::1';\n\n\t\t\tlet protocol = url.protocol;\n\t\t\tlet forcedHttps = false;\n\t\t\tif (!isLoopback && protocol !== 'https:') {\n\t\t\t\tprotocol = 'https:';\n\t\t\t\tforcedHttps = true;\n\t\t\t}\n\n\t\t\t// Build URL with hostname (not host) to avoid carrying\n\t\t\t// default-for-original-scheme ports across a protocol switch.\n\t\t\t// Drop port entirely when forcing HTTPS (Workers serve on standard ports).\n\t\t\tconst host = url.hostname.includes(':') ? `[${url.hostname}]` : url.hostname;\n\t\t\tconst portSuffix = (!forcedHttps && url.port) ? `:${url.port}` : '';\n\t\t\tbaseUrl = `${protocol}//${host}${portSuffix}`;\n\t\t} catch {\n\t\t\t// If URL parsing fails, baseUrl stays empty\n\t\t}\n\t}\n\n\tif (!baseUrl) {\n\t\tthrow new Error('VITE_BASE_URL must be configured (or provide a valid request URL for runtime detection)');\n\t}\n\n\treturn { apiUrl, baseUrl };\n}\n\nfunction createUserLocals(decoded: DecodedToken): UserLocals {\n\treturn {\n\t\tisAuthenticated: true,\n\t\tid: decoded.sub,\n\t\temail: decoded.email,\n\t\troles: decoded.roles || []\n\t};\n}\n\nasync function tryRefreshToken(event: RequestEvent, config: SentinelConfig, refreshToken: string | undefined, log: SentinelLogger, verifier: JwksVerifier | null): Promise<void> {\n\tif (!refreshToken) return;\n\n\ttry {\n\t\tconst sentinel = new SentinelClient(config, event.fetch);\n\t\tconst result = await sentinel.refreshToken(refreshToken);\n\n\t\tif (result.code === 0 || result.success) {\n\t\t\tif (result.access_token) {\n\t\t\t\tevent.cookies.set(COOKIE_NAMES.ACCESS_TOKEN, result.access_token, COOKIE_OPTIONS.ACCESS_TOKEN);\n\n\t\t\t\t// Handle refresh token rotation\n\t\t\t\tif (result.refresh_token) {\n\t\t\t\t\tevent.cookies.set(COOKIE_NAMES.REFRESH_TOKEN, result.refresh_token, COOKIE_OPTIONS.REFRESH_TOKEN_LONG);\n\t\t\t\t}\n\n\t\t\t\t// Verify the freshly-issued token's signature before trusting its\n\t\t\t\t// payload (same JWKS path as the cookie flow). The cookie is kept —\n\t\t\t\t// it was just minted by the backend over TLS — but locals.user is\n\t\t\t\t// only set when verification passes; the next request retries.\n\t\t\t\tconst decoded = await resolveVerifiedToken(result.access_token, verifier, log);\n\t\t\t\tif (decoded) {\n\t\t\t\t\tconst locals = event.locals as SentinelLocals;\n\t\t\t\t\tlocals.user = createUserLocals(decoded);\n\t\t\t\t\tlocals.accessToken = result.access_token;\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tlog.warn('Token refresh failed - continuing without user');\n\t\t}\n\t} catch (error) {\n\t\tlog.error('Token refresh error', { error: String(error) });\n\t}\n}\n\n"]}

package/dist/sveltekit/handlers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sveltekit/handlers/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EACX,kBAAkB,EAGlB,MAAM,qBAAqB,CAAC;AA0hB7B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,kBAAuB,GAAG;IAAE,GAAG,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CA8ClH"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sveltekit/handlers/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EACX,kBAAkB,EAGlB,MAAM,qBAAqB,CAAC;AAgiB7B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,kBAAuB,GAAG;IAAE,GAAG,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CA8ClH"}

package/dist/sveltekit/handlers/index.js

@@ -178,7 +178,13 @@ async function handlePoll(event, resolved) {
                     ...loginCookieOptions,
                     maxAge: 60 // 1 minute
                 });
-                return json({ status: 'completed', redirectTo: '/api/auth/claim' });
+                return json({
+                    status: 'completed',
+                    redirectTo: '/api/auth/claim',
+                    ...(result.redirect_context != null
+                        ? { redirect_context: result.redirect_context }
+                        : {})
+                });
             }
             else if (result.status === 'pending') {
                 return json({ status: 'pending' });